This vulnerability (CWE-427) affects LUCID Vision Labs Arena SDK version 1.0.80.49 on Windows. The SDK attempts to load DLL dependencies by searching directories listed in the PATH environment variable if the DLL is not found locally. A local attacker can exploit this behavior by placing a malicious DLL in a user-controlled directory earlier in the search order, causing the SDK to load the malicious DLL and execute arbitrary code with the application's privileges.

Successful exploitation allows local attackers to execute arbitrary code with the same privileges as the vulnerable application, potentially leading to full compromise of the application context, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 8.8 (High), reflecting high impact on confidentiality, integrity, and availability with low attack complexity and privileges required.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should restrict access to directories listed in the PATH environment variable to trusted users only and avoid running the vulnerable SDK with elevated privileges. Monitoring and controlling DLL search paths may help mitigate risk.